chore(deps): update dependency @angular/compiler to v19.2.18 [security] #83
Conversation
|
![ellipsis-dev[bot]](https://avatars.githubusercontent.com/in/64358?s=60&v=4){kind=small}
There was a problem hiding this comment.
Skipped PR review on 84b4857 because no changed files had a supported extension. If you think this was in error, please contact us and we'll fix it right away.
|
Important Review skippedBot user detected. To trigger a single review, invoke the You can disable this status message by setting the Comment |
|
This pull request is automatically built and testable in CodeSandbox. To see build info of the built libraries, click here or the icon next to each commit SHA. |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
renovate
bot
force-pushed
the
renovate/npm-angular-compiler-vulnerability
branch
from
84b4857 to
b7648d2
Compare
renovate
bot
changed the title
This PR contains the following updates:
19.2.1→19.2.18GitHub Vulnerability Alerts
CVE-2025-66412
A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. It occurs because the compiler's internal security schema is incomplete, allowing attackers to bypass Angular's built-in security sanitization. Specifically, the schema fails to classify certain URL-holding attributes (e.g., those that could contain
javascript:URLs) as requiring strict URL security, enabling the injection of malicious scripts.Additionally, a related vulnerability exists involving SVG animation elements (
<animate>,<set>,<animateMotion>,<animateTransform>). TheattributeNameattribute on these elements was not properly validated, allowing attackers to dynamically target security-sensitive attributes likehreforxlink:hrefon other elements. By bindingattributeNameto "href" and providing ajavascript:URL in thevaluesortoattribute, an attacker could bypass sanitization and execute arbitrary code.Attributes confirmed to be vulnerable include:
xlink:href), and various MathML attributes (e.g.,math|href,annotation|href).attributeNameattribute when bound to "href" or "xlink:href".When template binding is used to assign untrusted, user-controlled data to these attributes (e.g.,
[attr.xlink:href]="maliciousURL"or<animate [attributeName]="'href'" [values]="maliciousURL">), the compiler incorrectly falls back to a non-sanitizing context or fails to block the dangerous attribute assignment. This allows an attacker to inject ajavascript:URLpayload. Upon user interaction (like a click) on the element, or automatically in the case of animations, the malicious JavaScript executes in the context of the application's origin.Impact
When exploited, this vulnerability allows an attacker to execute arbitrary code within the context of the vulnerable application's domain. This enables:
Patches
Attack Preconditions
attributeNameof an SVG animation element.Workarounds
If you cannot upgrade, you can workaround the issue by ensuring that any data bound to the vulnerable attributes is never sourced from untrusted user input (e.g., database, API response, URL parameters).
[attr.xlink:href]="maliciousURL") to assign untrusted data to the vulnerable SVG/MathML attributes.attributeNameon SVG Animations: Do not bind untrusted data to theattributeNameattribute of SVG animation elements (<animate>,<set>, etc.).javascript:URLs.CVE-2026-22610
A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular Template Compiler. The vulnerability exists because Angular’s internal sanitization schema fails to recognize the
hrefandxlink:hrefattributes of SVG<script>elements as a Resource URL context.In a standard security model, attributes that can load and execute code (like a script's source) should be strictly validated. However, because the compiler does not classify these specific SVG attributes correctly, it allows attackers to bypass Angular's built-in security protections.
When template binding is used to assign user-controlled data to these attributes for example,
<script [attr.href]="userInput">the compiler treats the value as a standard string or a non-sensitive URL rather than a resource link. This enables an attacker to provide a malicious payload, such as adata:text/javascriptURI or a link to an external malicious script.Impact
When successfully exploited, this vulnerability allows for arbitrary JavaScript execution within the context of the victim's browser session. This can lead to:
Attack Preconditions
<script>elements within its templates.hreforxlink:hrefattributes of those SVG scripts.Patches
Workarounds
Until the patch is applied, developers should:
[attr.href]) for SVG<script>elements.Resources
Release Notes
angular/angular (@angular/compiler)
v19.2.18Compare Source
core
v19.2.17Compare Source
compiler
attributeNameand MathML/SVG URLsv19.2.16Compare Source
http
v19.2.15Compare Source
Breaking Changes
core
The server-side bootstrapping process has been changed to eliminate the reliance on a global platform injector.
Before:
After:
A schematic is provided to automatically update
main.server.tsfiles to pass theBootstrapContextto thebootstrapApplicationcall.In addition,
getPlatform()anddestroyPlatform()will now returnnulland be a no-op respectively when running in a server environment.core
BootstrapContextfor improved server bootstrapping (#63639)v19.2.14Compare Source
compiler
migrations
v19.2.13Compare Source
common
service-worker
v19.2.12Compare Source
common
compiler
compiler-cli
core
rxResourceabort listener (#58306)withEventReplay()is invoked (#61352)onDestroyintoSignal. (#61514)platform-server
v19.2.11Compare Source
v19.2.10Compare Source
common
updateLatestValueif view is destroyed before promise resolves (#61064)core
platform-server
v19.2.9Compare Source
core
v19.2.8Compare Source
forms
v19.2.7Compare Source
common
NgOptimizedImageexceeds the preload limit (#60883)core
http
httpResource(#60802)v19.2.6Compare Source
compiler
compiler-cli
core
language-service
v19.2.5Compare Source
animations
@angular/common(#60660)compiler
compiler-cli
rootDir(#60555)core
language-service
migrations
router
service-worker
v19.2.4Compare Source
core
localize
platform-browser
platformBrowserTestingincludesplatformBrowserproviders (#60480)v19.2.3Compare Source
compiler-cli
core
platform-browser-dynamic
@angular/common(#60458)upgrade
v19.2.2Compare Source
common
compiler
compiler-cli
core
platform-server
rxjs(#60308)router
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.